Testing cookies

server/admin/default-account.js

@@ -25,7 +25,7 @@ module.exports = async () => {
 	});
 
 	if (adminRecord == null) {
-		const webAddress = process.env.WEB_ADDRESS == 'localhost' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
+		const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
 			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,

server/auth/login.js

@@ -3,7 +3,7 @@ const utils = require('util');
 const bcrypt = require('bcryptjs');
 
 const { accounts } = require('../database/models');
-const tokenGenerate = require('../utilities/token-generate');
+const tokenGenerateRefresh = require('../utilities/token-generate-refresh');
 
 //utilities
 const validateEmail = require('../utilities/validate-email');
@@ -49,10 +49,13 @@ const route = async (req, res) => {
 	}
 
 	//generate the JWTs
-	const tokens = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	const { accessToken, refreshToken } = tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
+
+	//set the cookie
+	res.cookie('refreshToken', refreshToken, { httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 }); //30 days
 
 	//finally
-	res.status(200).json(tokens);
+	res.status(200).send(accessToken);
 	return null;
 };
 

server/auth/logout.js

@@ -2,7 +2,9 @@ const tokenDestroy = require('../utilities/token-destroy');
 
 //auth/logout
 const route = (req, res) => {
-	tokenDestroy(req.body.token);
+	//stored in the cookie
+	console.log(req.cookies.refreshToken)
+	tokenDestroy(req.cookies.refreshToken);
 
 	return res.status(200).end();
 };

server/auth/token.js

@@ -4,13 +4,16 @@ const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
-	const refreshToken = req.body.token;
+	console.log(req.cookies);
 
-	return tokenRefresh(refreshToken, (err, token) => {
+	return tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
 		if (err) {
 			return res.status(err).end();
 		}
 
-		return res.status(200).send(token);
+		//set the cookie
+		res.cookie('refreshToken', refreshToken, { httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 }); //30 days
+
+		return res.status(200).send(accessToken);
 	});
 };

server/server.js

@@ -6,10 +6,19 @@ const express = require('express');
 const app = express();
 const server = require('http').Server(app);
 const cors = require('cors');
+const cookieParser = require('cookie-parser');
 
 //config
 app.use(express.json());
-app.use(cors());
+
+app.use(cors({
+	credentials: true,
+	// origin: `${process.env.WEB_PROTOCOL}://${process.env.WEB_ADDRESS}`,
+	origin: true,
+	methods: ['HEAD', 'GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'TRACE', 'OPTIONS']
+}));
+
+app.use(cookieParser());
 
 //database connection
 const database = require('./database');

server/utilities/token-auth.js

@@ -3,13 +3,13 @@ const jwt = require('jsonwebtoken');
 //middleware to authenticate the JWT token
 module.exports = (req, res, next) => {
 	const authHeader = req.headers['authorization'];
-	const token = authHeader?.split(' ')[1]; //'Bearer token'
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
-	if (!token) {
-		return res.status(401).send('No token found');
+	if (!accessToken) {
+		return res.status(401).send('No access token found');
 	}
 
-	return jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
+	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {
 		if (err) {
 			return res.status(403).send(err);
 		}

server/utilities/token-destroy.js

@@ -1,9 +1,9 @@
 const { tokens } = require('../database/models');
 
-module.exports = (token) => {
+module.exports = (refreshToken) => {
 	tokens.destroy({
 		where: {
-			token: token || ''
+			token: refreshToken || ''
 		}
 	});
 }

server/utilities/token-generate-refresh.js

@@ -13,7 +13,7 @@ module.exports = (index, email, username, type, admin, mod) => {
 	};
 
 	//these are strings
-	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
+	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '1s', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
 	tokens.create({ token: refreshToken, email: email });

server/utilities/token-refresh.js

@@ -1,17 +1,17 @@
 const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
-const generate = require('./token-generate');
+const generate = require('./token-generate-refresh');
 const destroy = require('./token-destroy');
 
-module.exports = async (token, callback) => {
-	if (!token) {
+module.exports = async (oldRefreshToken, callback) => {
+	if (!oldRefreshToken) {
 		return callback(401);
 	}
 
 	const tokenRecord = await tokens.findOne({
 		where: {
-			token: token || ''
+			token: oldRefreshToken || ''
 		}
 	});
 
@@ -19,15 +19,15 @@ module.exports = async (token, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(token, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const result = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		destroy(token);
+		destroy(oldRefreshToken);
 
-		return callback(null, result);
+		return callback(null, accessToken, refreshToken);
 	});
 };